topic Re: Splunk search goes through 'main' index only in Splunk Search

Splunk search goes through 'main' index only

africates — Fri, 22 Aug 2014 11:40:46 GMT

Hi,

When I try to search anything through either 'Search & Reporting' or 'Splunk App for Windows Infrastructure' I am getting results only from 'main' index.

The same applies to 'Data Summary' - I'm only able to see the hosts which forwarded some events to 'main' index.

Can I change this somehow so search is executed on all indexes apart from these internal ones?

thanks
p

Re: Splunk search goes through 'main' index only

martin_mueller — Fri, 22 Aug 2014 11:59:12 GMT

You could either specify the index(es) you want to search in the search itself:

index=A OR index=B sourcetype=foo ...

Or you can add more indexes to the indexes searched by default for your user's role... which by default only searches index=main. There even is a button for "all non-internal indexes" at Settings -> Authentication -> Roles -> Your Role -> all the way at the bottom